…a in an no-escape argument (llvm#155025)

Fix a bug that webkit.UncountedLambdaCapturesChecker was erroneously
emitting a warning for a DeclRefExpr which is passed in as an argument
to a no-escape function argument. The bug was caused by findLambdaInArg
not adding DeclRefExpr to the ignored set even when a lambda was
identified as an argument.

This PR makes WebKit checkers treat NULL, 0, and nil like nullptr in
various places.

…ED. (llvm#157629)

This PR adds the support for treating a function return value to be safe
if the function is annotated with NS_RETURNS_RETAINED or
CF_RETURNS_RETAINED.

Like other functions which results in abort, treat asm brk instruction
as trivial.

…usly treated as unsafe if it's a template parameter (llvm#157993)

When a template class takes Ref<T> as a template parameter and this
template parameter is used as the return value of a member function, the
return value can be treated as unsafe (i.e. emits a false positive). The
issue was caused by getCanonicalType sometimes converting Ref<T> to T.
Workaround this problem by avoid emitting a warning when the original,
non-canonical type is a safe pointer type.

…singleton. (llvm#158012)